We set $CFG->directorypermissions to 0700 as recommended.

We had our PHP error reporting logged to httpd logs, but recently switched to a separate PHP error log file.

Moodle extracts $CFG->umaskpermissions and sets the processes umask right after.

Setting the umask with umask() overrides PHP's way to create the error log configured with the php.ini directive error_log, which would normally be created with 0644 permissions.

So basically, if you close up shop of moodledata, you simultaneously prevent the log from being read by "normal" users.

You should probably store the "regular" umask somewhere, and during logging something you should temporarily revert back to that old umask.